HTTP not redirecting HTTPS for Exchange

Recently I have encountered an issue with one of the servers we manage at work.

Supposedly, when they type in the website of the exchange site, in this case lets say mail.limdynasty.com they want it to be redirected to https://mail.limdynasty.com/owa

At first we thought that using the HTTP redirect from the “Default Web Site” in the IIS Manager (inetmgr) will do the job. But it wasn’t. Then we started to notice that by visiting https://mail.limdynasty.com the web server will execute the redirect we set in the HTTP Redirect.

What we didn’t realize is that setting the HTTP Redirect was just half way the process. We had to disable the “Require SSL” function from the “Default Web Site” in the SSL Settings.

It makes sense, since the redirection only occurs when the “Require SSL” function is on.

That means when the server receive the request for mail.limdynasty.com it will only allow secure connections, since mail.limdynasty.com is an implicit request for http://mail.limdynasty.com it will not execute the redirection the site is only accepting secure connection.

However when we disable the “Require SSL” from the SSL settings in the “Default Web Site” we are telling the server to accept unsecure connection (that is http). Combine this setting with the redirection, this makes perfect sense. We have already set the “HTTP Redirect” on the “Default Web Site”. After we disable the “Require SSL” for the “Default Web Site”, the server is now allowing the mail.limdynasty.com request, after it accepts the request, it will execute the redirect which is the https://mail.limdynasty.com/owa

 

Capture

 

Capture2